Fixes#192 — script and GHCR update flows now drop data/.last_update_result.json
the same way betterdesk.sh already does, so a failed in-panel attempt no longer
sticks around after a successful external update.
- Added functionality to clear stale update results when the local SHA matches the target SHA, preventing unnecessary warnings in the panel.
- Enhanced the update result persistence logic to filter out non-critical failures, ensuring only actionable errors are displayed.
- Updated the update service to handle remote SHA retrieval and integrate with the new result display logic.
- Improved tests for the update result handling to cover new behaviors and ensure reliability.
After deleting dev-only i18n scripts from the repo, post-update repair
was still trying to fetch them from GitHub (404). Exclude removed paths
from repair seeds and delete root-level script files on removal.
Hardened installs could not replace betterdesk-server in /opt/rustdesk
from Settings → Updates. Add a validated sudo deploy helper, extend
console update sudoers, and sync privileges before server deploy.
Fixes#183
Introduce bump-version.js with CI workflows for patch bumps on dev and
stable releases on main, plus panel and installer UI to choose stable vs
development GitHub update branches.
Added a new API endpoint to retrieve the last update result, enhancing the user interface by displaying detailed error messages for failed updates. Improved the update completion modal to reflect the status of services and console restarts, ensuring users are informed of any issues. Updated the settings JavaScript to load and display the last update result dynamically, improving overall user experience during updates.
Improved the update process by adding detailed error reporting for failed updates, including specific file and service errors. Implemented a function to manage passwordless sudoers for console service restarts, ensuring smoother updates on Linux systems. Enhanced npm installation error handling to capture and log detailed failure messages.
Introduced a new function, isResolvedByIndexModule, to determine if a local path is resolved by an index module. This enhancement allows the repair process to skip phantom routes when an index.js file exists, improving the accuracy of the console file repair logic. Added corresponding tests to validate this behavior.
Enhanced the update process to better manage console restarts by checking for blocked permissions before attempting a restart. Added logic to handle cases where console service user permissions are not verified, ensuring that appropriate messages are logged and the update phase is accurately reflected. Updated the console restart scheduling to occur after the response is sent, improving overall reliability. Additionally, modified the comment handling in the dependency scanning process to ignore requires within comments.
Continue full-tree sync and missing-file repair when individual GitHub
downloads fail, matching ensureServerSource behaviour and reporting each
failure in update results instead of aborting the whole operation.
GitHub compare returns at most 300 changed files, so in-app panel updates could
deploy updated routes without new service modules (e.g. serverAttestation.js).
Add full web-nodejs tree sync on truncated diffs and repair missing local require
targets after incremental console updates.
Updated the build scripts to include the server library in the agent build process. Introduced new environment variables for Go module and build caches to improve build efficiency. Enhanced the generator route to support multiple languages and added locale labels for better user experience. Updated the generator view to dynamically populate language options based on supported languages.
On flat Linux deployments, server source sync was writing to /opt/betterdesk-server
instead of the console directory, causing EACCES during rebuild and updates.
Go toolchain downloads and sumdb checks also use $HOME/go even when
GOMODCACHE is set. Point HOME at the console data directory during
server auto-rebuilds.
Point GOMODCACHE and GOCACHE at data/go-cache when auto-rebuilding the
server binary. The betterdesk service user often has HOME=/var/lib/betterdesk
which may not be writable, causing "could not create module cache" on update.
Sync console file ownership before the dedicated service user starts, add
ExecStartPre permission repair on systemd, and skip in-app restart when
permissions are not verified so the panel does not die with Bad Gateway.
Use npm install without a lockfile in CI, treat root-owned installer scripts as non-critical update failures, and skip privileged H-7 hooks when betterdesk already exists without sudo.
Hash RustDesk access tokens at rest (phase 1), add SSRF guards for admin network tools with LAN monitoring support, run dedicated console service user on Linux, and hook post-update verification plus service patching into both betterdesk.sh and the in-app updater.
The panel updater assumed a native install with Go source on disk. In
Compose/GHCR mode it now uses the embedded image commit, clears stale
binary markers, and directs operators to pull new container images instead.
- Updated the UI to utilize a new status handling method, enhancing the display of connection and enrollment statuses.
- Introduced a status dot indicator for better visual feedback on connection state.
- Refactored the Go toolchain installation script to verify the presence of the JSON package instead of PNG, improving compatibility checks.
- Enhanced error handling in the agent build worker to streamline the build process and ensure proper environment setup.
- Added new UI components and functionality for managing client builds, including a section for displaying build statuses and a button to rebuild all platform installers.
- Enhanced the generator routes to support rebuilding of bundles, including error handling for revoked bundles.
- Updated the agent build worker to facilitate the rebuilding process for platform builds associated with a specific bundle.
- Improved localization by adding relevant strings for build management in English and Polish language files.
- Introduced CSS styles for the new builds section to enhance visual presentation and user experience.
- Simplified the health check for the Go binary in agentBuildWorker by utilizing a new method from updateService to verify the standard library.
- Enhanced the installation process of the Go toolchain to handle concurrent requests and added an option to limit the maximum version during installation.
- Improved error handling and cleanup in the goStdlibHealthy function to ensure temporary files are removed after checks.
- Updated the resolveGoRelease function to support version constraints, ensuring compatibility with specified maximum versions.
- Updated the agentBuildWorker to return null if no healthy Go binary is found, improving error handling.
- Enhanced the updateService with a new function to verify the integrity of the Go standard library, ensuring a complete installation.
- Implemented additional checks during Go toolchain installation to handle incomplete standard library scenarios, improving reliability and user feedback.
- Added functionality to track the remote SHA of the agent source, improving consistency during updates.
- Implemented a new method to sync the full support-agent source from GitHub, ensuring all necessary files are staged for rebuilds.
- Introduced a mechanism to check for agent source drift, allowing for automatic repairs when discrepancies are detected.
- Updated the update service to trigger agent source synchronization and rebuilds based on specific file changes, streamlining the update workflow.
- Implemented a conditional staging process for the Go support-agent source during updates, creating a rebuild flag for generator bundles.
- Added functions to handle the requeuing of builds and marking rebuilds as pending, improving the update workflow.
- Updated the update service to stage support-agent files and trigger rebuilds after in-app updates.
- Removed the obsolete GitHub Actions workflow for the support agent, streamlining CI/CD processes.
Merge .env keys instead of replacing files, patch systemd/NSSM in place,
block panel updates when the server cannot be rebuilt, and stop routine
updates from syncing admin passwords from .env into auth.db/PostgreSQL.
Let server.config admins edit .env, blocklist, and systemd units from the
panel with backups on save and service restart via the existing updater.
Co-authored-by: Cursor <cursoragent@cursor.com>
The in-app updater computed changed files via the GitHub compare API, whose 'files' array is capped at 300 entries. Large updates were truncated, so changed Go callee files (codec/ws.go, peer/map.go, auth/ldap.go, auth/oidc.go) were never downloaded, leaving inconsistent on-disk source that failed 'go build' with 'undefined' errors. ensureServerSource() also short-circuited whenever go.mod existed, so the full-resync safety net never ran.
Fixes: ensureServerSource() gains a force option that performs a full, consistent source resync (git clone / tree API) regardless of go.mod presence; called with force from applyUpdate's server block and from rebuildServerBinary (the 'Rebuild server binary' button).
Installer parity (same #158 class): betterdesk.sh, betterdesk.ps1 and betterdesk-docker.sh copied the source *directory* into the destination, which nested the new tree inside the stale dir when the pre-update rename/mv failed on a locked file. They now copy *contents* into a guaranteed-existing dir while preserving data/ and node_modules/.
This commit was made possible thanks to Insolve.
Bump golang.org/x/crypto to v0.52.0 and x/sys to v0.45.0 in betterdesk-server, x/sys to v0.45.0 in betterdesk-agent, and aiohttp to >=3.10.11 in the rest-webhook bridge. Validated clean via govulncheck.
Add an explicit Go server rebuild path to the in-app updater so security/library updates actually reach the running binary: updateService now marks the server binary stale when the source changed but a non-critical rebuild/deploy step failed, exposes getServerBinaryStatus() and rebuildServerBinary(), and surfaces a warning banner plus a Rebuild button in the settings update panel. New REST endpoints GET/POST /api/settings/updates/server-binary/{status,rebuild} guarded by server.config permission. i18n keys added across all locales.
This commit was made possible thanks to Insolve.
Privilege separation across all installers so the long-running services no longer run with full administrative rights:
betterdesk.sh: installer keeps root but systemd units now run as a dedicated unprivileged 'betterdesk' system account by default (auto-created via ensure_service_user). Added full systemd hardening for the Go server (NoNewPrivileges, ProtectSystem=strict, ProtectHome, PrivateTmp, ReadWritePaths) and light hardening for the Node.js console. chown migrates existing root-owned data to the service account on update. Opt-out via --run-as-root / BETTERDESK_RUN_AS_ROOT=1; custom account via BETTERDESK_SERVICE_USER. Minimal mode covered too.
betterdesk.ps1: NSSM services now run under their per-service low-privilege virtual accounts (NT SERVICE\<service>) instead of LocalSystem, with scoped icacls grants on the install/data dirs (Set-ServiceLeastPrivilege helper). Applied to the Go server, Node.js console and minimal-mode service. Opt-out via -RunAsRoot / BETTERDESK_RUN_AS_ROOT=1.
Docker: verified already privilege-separated (supervisord drops both programs to user=betterdesk; multi-container images drop via su-exec).
Also bundles in-progress changes to the Go server API, Node.js console services and Docker compose/Dockerfiles.
This commit was made possible thanks to Insolve.
updateService.js: distinguish critical vs non-critical failures in SHA tracking. Server binary compile/download failures are non-critical — SHA is saved so the same update is not shown again on restart. update-cli.js: match same logic, non-critical failures don't set exit code 1. betterdesk.sh: new update_from_github() with git clone + tarball fallback, 3-method menu. betterdesk.ps1: new Update-FromGitHub with git clone + ZIP fallback, 3-method menu. betterdesk-docker.sh: new update_docker_from_github() with 2-method menu.
This commit was made possible thanks to Insolve.
- Updated Polish and Chinese language files to reflect changes in update descriptions and confirmations.
- Modified settings.js to automatically include server updates in the update process.
- Simplified the update installation API to automatically handle server updates without user intervention.
- Improved updateService.js to ensure all supported components are updated together, enhancing reliability.
- Added logic to check and install the Go toolchain as needed during updates, ensuring compatibility.
- Enhanced error handling and logging during the update process for better visibility of issues.
Three independent bug fixes bundled together; none of the issues are
auto-closed by this commit so the reporters can confirm on a tagged build.
#121 — NAT hairpin: same-public-IP detection forces relay path
The signal handler now distinguishes 'same /24 private subnet' (genuine
LAN, keep direct path) from 'same public IP' (NAT hairpin scenario).
When both peers register from the same public IP, both the UDP and
TCP/WS punch-hole handlers skip the LAN-address exchange and steer the
client straight to the relay — matching upstream RustDesk behavior.
Most consumer routers and cellular gateways drop hairpinned UDP, which
was causing same-Wi-Fi connections to silently time out.
- new helper isSamePublicIP() in signal/handler.go
- new config flag SameNATRelay (default: enabled)
- env: SAME_NAT_RELAY=N to opt out
- cli: --same-nat-relay=false to opt out
Reported-by: @eternalliving (#121)
#122 — Rate limit configurable, 0 disables
The 20 registrations/min/IP cap was unworkable for any deployment with
real NAT/CGNAT in front of it. Made it tunable without recompiling and
hardened the limiter to short-circuit when disabled.
- new config field SignalRateLimitPerIP (default: 20, unchanged)
- env: SIGNAL_RATE_LIMIT_PER_IP=<n> (0 = unlimited)
- cli: --signal-rate-limit-per-ip=<n>
- ratelimit.IPLimiter.Allow() now returns true early when limit<=0
Reported-by: @Henry-739 (#122)
#123 — Updater corrupting live SQLite WAL files
A previous gitleaks-fix commit accidentally tracked live SQLite sidecar
files (auth.db-shm/wal, betterdesk.db-shm/wal, .session_secret,
.update_sha). The in-app updater's diff-against-GitHub logic then
'restored' those tracked-by-mistake files on user installs, which is
exactly how SQLite database corruption gets manufactured.
Layered defense:
- .gitignore now covers *.db-shm, *.db-wal, *.sqlite3-{shm,wal,journal},
web-nodejs/data/, .session_secret, .update_sha, .api_key,
.admin_credentials, .force_password_update, .env*
- removed the offending files from the index (data/.gitkeep retained)
- updateService.js EXCLUDE_PATTERNS extended to match the new gitignore
- new write-time guard isProtectedRuntimePath() wired into all four
write sites in updateService.js so even a stale GitHub diff cannot
overwrite a runtime state file on disk
Reported-by: @SterlynKong (#123)
- deployServerBinary: use rename(2) for atomic replace, fixes ETXTBSY
when target Go binary is busy (Linux kernel handles inode swap).
Falls back to copyFileSync on cross-device rename or non-Linux.
Windows: rename target out of the way first, then move new in.
- settings.js: mark 'server' phase as error when build succeeded but
deploy failed (was incorrectly marking 'done' from build alone).
- settings.js: completion modal now shows error title, error message
and pre-formatted stderr when serverDeploy.success === false.
- i18n: added complete_with_errors, modal_done_with_errors_title in
en/pl.
- updateService: enhanced checkGoAvailable() to scan well-known paths
(/usr/local/go, /snap, vendored data/go-toolchain, /usr/lib/go-1.x)
and return absolute binary path so spawned exec works without PATH.
- New installGoToolchain(): dynamically fetches go.dev/dl/?mode=json,
picks newest stable >= 1.23.0 for current OS/arch, downloads archive,
verifies SHA-256 from manifest, extracts to data/go-toolchain/.
- buildGoServer() now uses absolute go path, 600s timeout.
- New 'install-go' update strategy + auto-fallback in 'auto' mode:
when host has neither Go nor a prebuilt release, the toolchain is
installed automatically and compilation proceeds.
- New POST /api/settings/updates/install-go endpoint for explicit
install (audit-logged, server.config permission gated).
- Settings UI: third 'Auto-install Go and compile' radio. Update
checkbox is no longer disabled when Go is missing — auto-install
is always offered as a fallback.
- installUpdate() rewritten as Modal-based phased dialog:
Confirmation -> Backup -> Console -> Server -> Restart -> Done.
Live phase icons (pending/active/done/error/skipped), progress bar,
log pane, completion modal with reload CTA, auto-reload after
successful console restart.
- New i18n keys (EN+PL): strategy_install_go, auto_strategy,
toolchain_*, modal_*, phase_*, confirm_*, etc.
- New CSS (.update-progress-modal, .update-phase, .update-progress-log).
Expose an update strategy UI and support downloading pre-built server binaries as an alternative to compiling from source.
- Add new translation keys (en/pl/zh) for strategy labels, badges, download/build messages and install Go hint.
- Update settings UI: show strategy selection (download / compile), badges with availability/release/size, auto-select best strategy, and adjust status/info messages and progress text.
- settings.routes: make server-info handler async and include prebuilt info; accept serverStrategy in updates/install request and forward to updateService.
- updateService: add helpers getReleaseBinaryName, checkPrebuiltAvailable, downloadPrebuiltBinary and getPrebuiltInfo; extend getServerUpdateInfo to include expected binary/platform/arch. Implement server update flow to support compile or download strategies (auto fallback), download/prep binary, validate size, deploy binary, and record method/size in results.
This enables faster updates on platforms with prebuilt releases while preserving the compile-from-source path and providing clear UI feedback and fallbacks.
Enable optional compilation and deployment of the Go server as part of the self-update flow. UI: add checkbox/status/info area in settings.js, check /api/settings/updates/server-info, include server component when selected, adjust progress/messages and longer timeouts. API/Server: add server-info endpoint and extend install request timeouts. Service: updateService now sets server localRoot and implements functions to detect Go, fetch server source (git or GitHub API), build the binary, and deploy it. i18n: add related translation keys across many locale files. Misc: improve input validation and error logging in desktop.routes, and return graceful defaults for missing policy routes in policies.routes.
- Replace release-based check (always 404) with commit-SHA tracking
- Track deployed state via data/.update_sha file
- Detect changes across all components (console, server, agent, scripts)
- Show recent commits, component breakdown, and file counts
- Auto-update console + script files, manual badge for Go server
- Pre-update backup with SHA-tracked restore
- Support npm install when package.json changes
- Service restart for console (auto) and Go server (on demand)
- 15 new i18n keys in EN/PL/ZH for update UI
- CSS for commit list, component rows, rebuild warning
- Change default GITHUB_REPO from 'Rustdesk-FreeConsole' to 'BetterDesk'
(repo was renamed, causing 404 on releases/latest API call)
- Handle 404 gracefully when no GitHub releases exist yet: return
'up to date' response instead of throwing error
- Add 'updateAvailable' and 'releaseNotes' fields to response object
(frontend settings.js expects these field names)
Introduce a SessionManager for relay-based remote sessions in the Tauri MGMT client: new SessionCommand API, start/stop/session input routing, clipboard/recording/quality controls, and notification read/dismiss state. Wire AppState with new mutexes and show main window on startup. CI: add SBOM generation (anchore) and Trivy vulnerability scan steps. Misc: change console Docker DB path, large README/CHANGELOG updates (chat E2E, unattended access/WOL, i18n expansion, CDAP/SDK docs), and many web-nodejs assets/locales/routes/views/services and server-side changes.
UNITRONIX